Reporting index management

Elastic Stack Kibana
1

I can see a lot of report indices that creates several shards. The reason is that I have several kibana indices, and I need as many reporting indices. It increases the number of shards I have, and I am chasing them to reduce the count

How can I customize it? I'd like to use rollover indices instead of per week indices (https://www.elastic.co/guide/en/kibana/current/reporting-settings-kb.html#reporting-advanced-settings)

.reporting-2019.10.20                                  1
.reporting-2019.10.20                                  1
.reporting-2020.02.16                                  1
.reporting-2020.02.16                                  1
...
.reporting-metrics-2018.12.09                          1
.reporting-metrics-2018.12.09
2

Interesting question.

@tsullivan/@joelgriffith do you have any inputs please?

Thanks,
Bhavya

3

The default Reporting settings allow weekly rollover. If you want to change it to use daily indices instead, you can set xpack.reporting.queue.indexInterval to day (default is week): https://www.elastic.co/guide/en/kibana/current/reporting-settings-kb.html#reporting-job-queue-settings

Kibana also has Index Management / Index Lifecycle Management which can allow you to customize "warm" and "cold" phases of the indices.

I'm not sure if lifecycle management would work if you tried to set up rollovers by adding a "Hot phase" of rollovers in the index lifecycle policy: that requires the application to read / write to an index alias.